79959f2b2639f363049bb668cfd980b6df8323eca9d32c6850cea9d5b4d244c6

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4626995a1e1fafb7fca5051be5090a0_JaffaCakes118.pdf
Size

69KB
MD5

d4626995a1e1fafb7fca5051be5090a0
SHA1

6f88a557874bc41d73add9a5fff45a771457b43d
SHA256

79959f2b2639f363049bb668cfd980b6df8323eca9d32c6850cea9d5b4d244c6
SHA512

b09eaea1a0ada37e977232d31157fab529f273b07f451c73e6a55c0a744f9e0af591ddd70a3fb14464e78f53989fb49dd4bc99763239d770269c96d80efc65af
SSDEEP

1536:/SY+zxJIGrCiuIhAJA3UAfU0Y3ZPU4I2zLe91OeQBBSkVF:6YMxfuIhAJGhfjSZPUHbJoBB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2364	AcroRd32.exe
2364	AcroRd32.exe
2364	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d4626995a1e1fafb7fca5051be5090a0_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b544667938324d41280468e0f7d9ad5

SHA1
96f20c3a0292eecfbc368d7000556b3cee7297a8

SHA256
576db321b0b8673a81e145995bfdd4a993f24071bbf836bbdc080feec7e6016d

SHA512
c4c6272101774e645bca37b560835506d6b724ad6a163ffd9f17da303ec451276ca949221b5f11e2823e970efc07123b9d3be15cd960ab8a4e41aa3aadc1dcb9

Download Submit